topic Re: count if two nonconsecutive string occurs in a statement in Splunk Search

count if two nonconsecutive string occurs in a statement

ataunk — Wed, 30 Sep 2020 05:00:40 GMT

I want to write a query to take the count if two non-consecutive string occurs in a statement. I am trying to do something like this, but this is not able to take logical AND operator in the match method :

Note : I want to use the query using eval only as in my larger query I have to perform some mathematical operation using more (different) eval variables.

| eval concatsearch=if(match(_raw,"String1 && String2"),1,0) |
eval ccount=if(match(_raw,"cc"),1,0) |
timechart span=1h
sum(concatsearch) as concatsearch,
sum(ccount) as ccount

Re: count if two nonconsecutive string occurs in a statement

DalJeanis — Tue, 14 Apr 2020 17:13:36 GMT

There are many ways to do that, but this one should work:

  | eval concatsearch=if(match(_raw,"String1"),1,0)*if(match(_raw,"String2"),1,0)

If either string is not matched, a zero value will result, if both match, a 1 value will result.

Re: count if two nonconsecutive string occurs in a statement

ataunk — Tue, 14 Apr 2020 17:17:42 GMT

Thanks so much. It works. Love Splunk comunity.

Re: count if two nonconsecutive string occurs in a statement

DalJeanis — Wed, 15 Apr 2020 15:25:30 GMT

Yeah, me too. Okay, if that solved your problem, then please "accept" the answer, so it will show as solved.

Re: count if two nonconsecutive string occurs in a statement

ataunk — Wed, 15 Apr 2020 16:21:41 GMT

I just tried to re-run the query and doesn;t look like it is giving the data.. I fi run this query it does give me data

("String1" AND "String2") | timechart count span=1h |sort -_time

Can you please review your query above once

Re: count if two nonconsecutive string occurs in a statement

ataunk — Wed, 30 Sep 2020 04:57:29 GMT

Also, the entire query I am running is :

| eval concatsearch=if(match(_raw,"String1"),1,0)*if(match(_raw,"String2"),1,0)
| timechart sum(concatsearch) span=1h

And I get 0 results, but those string are actually there. Am I doing something worng while using the sum and timechat ?